refactor: pure env_file stack.env convention across all stacks

Every service now reads stack.env via env_file with container-exact var
names — no ${VAR} parse-time interpolation, no Portainer UI env vars
(except stacks/dev, kept on UI-env interpolation as documented exception).

- media: drop PUID/PGID/TZ env lines (env_file covers); resolve ${ROOT}
- foundry: secrets via env_file; FOUNDRY_PATCH_URLS -> CONTAINER_PATCH_URLS
- monitoring: HOMARR_SECRET_ENCRYPTION_KEY -> SECRET_ENCRYPTION_KEY
- notify: FRESHRSS_USER composed in stack.env; TZ via env_file
- owncloud: container-exact OWNCLOUD_*/MYSQL_* keys; runtime $$ healthcheck
- resume/famapp: composites (DATABASE_URL etc.) written out in stack.env
- authentik: container-exact keys; image tag pinned in compose
- notes: couchdb creds via env_file
- remote: gains stack.env (no secrets; convention completeness)
- CLAUDE.md: env convention, valhalla-lab registration-only note, correct
  on-host Portainer working-copy path (/config/portainer/compose/<id>)

Validated with docker compose config on valhalla for all 15 stacks.

stacks/famapp/docker-compose.yml

@@ -10,33 +10,15 @@
 services:
   famapp:
     container_name: famapp
-    image: ${FAMAPP_IMAGE:-ghcr.io/ginnoir/famapp:latest}
-    pull_policy: ${FAMAPP_PULL_POLICY:-always}
+    image: ghcr.io/ginnoir/famapp:latest
+    pull_policy: always
     restart: unless-stopped
     networks: [famapp, edge]
     env_file:
       - stack.env
     environment:
       NODE_ENV: production
-      AUTH_URL: ${AUTH_URL}
-      DATABASE_URL: postgres://${FAMAPP_DB_USER}:${FAMAPP_DB_PASSWORD}@famapp-db:5432/${FAMAPP_DB_NAME}
-      AUTH_SECRET: ${FAMAPP_AUTH_SECRET}
-      AUTH_OIDC_ISSUER: ${AUTH_OIDC_ISSUER}
-      AUTH_OIDC_CLIENT_ID: ${AUTH_OIDC_CLIENT_ID}
-      AUTH_OIDC_CLIENT_SECRET: ${AUTH_OIDC_CLIENT_SECRET}
-      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
-      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
-      VAPID_SUBJECT: ${VAPID_SUBJECT}
-      NTFY_URL: ${NTFY_URL:-}
-      NTFY_TOPIC: ${NTFY_TOPIC:-}
-      LOG_LEVEL: ${LOG_LEVEL:-info}
-      RUN_MIGRATIONS: ${RUN_MIGRATIONS:-true}
       MINIO_ENDPOINT: http://famapp-minio:9000
-      MINIO_ROOT_USER: ${famapp_MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${famapp_MINIO_ROOT_PASSWORD}
-      MINIO_BUCKET: ${famapp_MINIO_BUCKET}
-      OPENPLANTBOOK_CLIENT_ID: ${famapp_OPENPLANTBOOK_CLIENT_ID}
-      OPENPLANTBOOK_CLIENT_SECRET: ${famapp_OPENPLANTBOOK_CLIENT_SECRET}
     ports:
       - "3010:3000"
     depends_on:
@@ -52,14 +34,10 @@ services:
     networks: [famapp]
     env_file:
       - stack.env
-    environment:
-      POSTGRES_USER: ${FAMAPP_DB_USER}
-      POSTGRES_PASSWORD: ${FAMAPP_DB_PASSWORD}
-      POSTGRES_DB: ${FAMAPP_DB_NAME}
     volumes:
       - /config/famapp/postgres:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${FAMAPP_DB_USER} -d ${FAMAPP_DB_NAME}"]
+      test: ["CMD-SHELL", "pg_isready -U famapp -d famapp"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -72,9 +50,6 @@ services:
     networks: [famapp]
     env_file:
       - stack.env
-    environment:
-      MINIO_ROOT_USER: ${famapp_MINIO_ROOT_USER}
-      MINIO_ROOT_PASSWORD: ${famapp_MINIO_ROOT_PASSWORD}
     volumes:
       - /storage1/labdata/famapp/minio:/data
     ports:

stacks/famapp/stack.env

@@ -1,16 +1,21 @@
-# famapp stack secrets
-FAMAPP_IMAGE=ghcr.io/ginnoir/famapp:latest
-FAMAPP_PULL_POLICY=always
+# famapp stack secrets — injected into all services via env_file.
+# Var names are exactly what each container reads (no ${VAR} interpolation,
+# no Portainer UI env vars). POSTGRES_* (db) are embedded in DATABASE_URL
+# (app) — keep them in sync on rotation. MINIO_ROOT_* are shared by the app
+# and the minio server. Image tag is pinned in docker-compose.yml.
 RUN_MIGRATIONS=true
 LOG_LEVEL=info
 
 AUTH_URL=https://fam.ginnoir.com
-FAMAPP_DB_USER=famapp
-FAMAPP_DB_PASSWORD=a9a999d16dd5cdc521bb62eff331265d3c24
-FAMAPP_DB_NAME=famapp
 
-# famapp Auth.js session secret (mapped to the container's AUTH_SECRET)
-FAMAPP_AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=
+# postgres (db container) + the composed URL the app reads
+POSTGRES_USER=famapp
+POSTGRES_PASSWORD=a9a999d16dd5cdc521bb62eff331265d3c24
+POSTGRES_DB=famapp
+DATABASE_URL=postgres://famapp:a9a999d16dd5cdc521bb62eff331265d3c24@famapp-db:5432/famapp
+
+# famapp Auth.js session secret
+AUTH_SECRET=CJsICgBs78YxxSdJfS8KU9Zn9k+QytRoVui9kVtuHtI=
 
 # OIDC via Authentik (public URL through Caddy — no container dependency)
 AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/
@@ -25,9 +30,9 @@ NTFY_URL=https://ntfy.ginnoir.com
 NTFY_TOPIC=famapp
 
 # MinIO object storage (plant/container image uploads)
-famapp_MINIO_ROOT_USER=famapp
-famapp_MINIO_ROOT_PASSWORD=d0fet0th3x
-famapp_MINIO_BUCKET=garden
+MINIO_ROOT_USER=famapp
+MINIO_ROOT_PASSWORD=d0fet0th3x
+MINIO_BUCKET=garden
 
-famapp_OPENPLANTBOOK_CLIENT_ID=5JdQLab69RhVaF4er7b7D29BCrkf3fo3OEiDsOQa
-famapp_OPENPLANTBOOK_CLIENT_SECRET=kxPTrdQPAVta7sjVuIRf5EGIJ1fKvlMlqRSJpQtFxRftJhg7oeGnXzwH7ls6tluQLFUYVDYRMwISiAuKZGZLvkuJzUwFGCwhZw7UtW8OvcTGy4717WeNUinvuCDSsNXP
+OPENPLANTBOOK_CLIENT_ID=5JdQLab69RhVaF4er7b7D29BCrkf3fo3OEiDsOQa
+OPENPLANTBOOK_CLIENT_SECRET=kxPTrdQPAVta7sjVuIRf5EGIJ1fKvlMlqRSJpQtFxRftJhg7oeGnXzwH7ls6tluQLFUYVDYRMwISiAuKZGZLvkuJzUwFGCwhZw7UtW8OvcTGy4717WeNUinvuCDSsNXP